Commit f7cfd871 authored by Eric W. Biederman's avatar Eric W. Biederman
Browse files

exec: Transform exec_update_mutex into a rw_semaphore 

Recently syzbot reported[0] that there is a deadlock amongst the users
of exec_update_mutex.  The problematic lock ordering found by lockdep
was:

   perf_event_open  (exec_update_mutex -> ovl_i_mutex)
   chown            (ovl_i_mutex       -> sb_writes)
   sendfile         (sb_writes         -> p->lock)
     by reading from a proc file and writing to overlayfs
   proc_pid_syscall (p->lock           -> exec_update_mutex)

While looking at possible solutions it occured to me that all of the
users and possible users involved only wanted to state of the given
process to remain the same.  They are all readers.  The only writer is
exec.

There is no reason for readers to block on each other.  So fix
this deadlock by transforming exec_update_mutex into a rw_semaphore
named exec_update_lock that only exec takes for writing.

Cc: Jann Horn <jannh@google.com>
Cc: Vasiliy Kulikov <segoon@openwall.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Bernd Edlinger <bernd.edlinger@hotmail.de>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Christopher Yeoh <cyeoh@au1.ibm.com>
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: Sargun Dhillon <sargun@sargun.me>
Cc: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Fixes: eea96732 ("exec: Add exec_update_mutex to replace cred_guard_mutex")
[0] https://lkml.kernel.org/r/00000000000063640c05ade8e3de@google.com


Reported-by: default avatar <syzbot+db9cdf3dd1f64252c6ef@syzkaller.appspotmail.com>
Link: https://lkml.kernel.org/r/87ft4mbqen.fsf@x220.int.ebiederm.org


Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent 31784cff

fs/exec.c

+6 −6
Original line number Diff line number Diff line
@@ -965,8 +965,8 @@ EXPORT_SYMBOL(read_code); 


/*

 * Maps the mm_struct mm into the current task struct.

 * On success, this function returns with the mutex

 * exec_update_mutex locked.

 * On success, this function returns with exec_update_lock

 * held for writing.

 */

static int exec_mmap(struct mm_struct *mm)

{
@@ -981,7 +981,7 @@ static int exec_mmap(struct mm_struct *mm) 
	if (old_mm)

		sync_mm_rss(old_mm);



	ret = mutex_lock_killable(&tsk->signal->exec_update_mutex);

	ret = down_write_killable(&tsk->signal->exec_update_lock);

	if (ret)

		return ret;
@@ -995,7 +995,7 @@ static int exec_mmap(struct mm_struct *mm) 
		mmap_read_lock(old_mm);

		if (unlikely(old_mm->core_state)) {

			mmap_read_unlock(old_mm);

			mutex_unlock(&tsk->signal->exec_update_mutex);

			up_write(&tsk->signal->exec_update_lock);

			return -EINTR;

		}

	}
@@ -1382,7 +1382,7 @@ int begin_new_exec(struct linux_binprm * bprm) 
	return 0;



out_unlock:

	mutex_unlock(&me->signal->exec_update_mutex);

	up_write(&me->signal->exec_update_lock);

out:

	return retval;

}
@@ -1423,7 +1423,7 @@ void setup_new_exec(struct linux_binprm * bprm) 
	 * some architectures like powerpc

	 */

	me->mm->task_size = TASK_SIZE;

	mutex_unlock(&me->signal->exec_update_mutex);

	up_write(&me->signal->exec_update_lock);

	mutex_unlock(&me->signal->cred_guard_mutex);

}

EXPORT_SYMBOL(setup_new_exec);

fs/proc/base.c

+5 −5
Original line number Diff line number Diff line
@@ -405,11 +405,11 @@ print0: 


static int lock_trace(struct task_struct *task)

{

	int err = mutex_lock_killable(&task->signal->exec_update_mutex);

	int err = down_read_killable(&task->signal->exec_update_lock);

	if (err)

		return err;

	if (!ptrace_may_access(task, PTRACE_MODE_ATTACH_FSCREDS)) {

		mutex_unlock(&task->signal->exec_update_mutex);

		up_read(&task->signal->exec_update_lock);

		return -EPERM;

	}

	return 0;
@@ -417,7 +417,7 @@ static int lock_trace(struct task_struct *task) 


static void unlock_trace(struct task_struct *task)

{

	mutex_unlock(&task->signal->exec_update_mutex);

	up_read(&task->signal->exec_update_lock);

}



#ifdef CONFIG_STACKTRACE
@@ -2930,7 +2930,7 @@ static int do_io_accounting(struct task_struct *task, struct seq_file *m, int wh 
	unsigned long flags;

	int result;



	result = mutex_lock_killable(&task->signal->exec_update_mutex);

	result = down_read_killable(&task->signal->exec_update_lock);

	if (result)

		return result;
@@ -2966,7 +2966,7 @@ static int do_io_accounting(struct task_struct *task, struct seq_file *m, int wh 
	result = 0;



out_unlock:

	mutex_unlock(&task->signal->exec_update_mutex);

	up_read(&task->signal->exec_update_lock);

	return result;

}

include/linux/sched/signal.h

+6 −5
Original line number Diff line number Diff line
@@ -228,11 +228,12 @@ struct signal_struct { 
					 * credential calculations

					 * (notably. ptrace)

					 * Deprecated do not use in new code.

					 * Use exec_update_mutex instead.

					 * Use exec_update_lock instead.

					 */

	struct mutex exec_update_mutex;	/* Held while task_struct is being

					 * updated during exec, and may have

					 * inconsistent permissions.

	struct rw_semaphore exec_update_lock;	/* Held while task_struct is

						 * being updated during exec,

						 * and may have inconsistent

						 * permissions.

						 */

} __randomize_layout;

init/init_task.c

+1 −1
Original line number Diff line number Diff line
@@ -26,7 +26,7 @@ static struct signal_struct init_signals = { 
	.multiprocess	= HLIST_HEAD_INIT,

	.rlim		= INIT_RLIMITS,

	.cred_guard_mutex = __MUTEX_INITIALIZER(init_signals.cred_guard_mutex),

	.exec_update_mutex = __MUTEX_INITIALIZER(init_signals.exec_update_mutex),

	.exec_update_lock = __RWSEM_INITIALIZER(init_signals.exec_update_lock),

#ifdef CONFIG_POSIX_TIMERS

	.posix_timers = LIST_HEAD_INIT(init_signals.posix_timers),

	.cputimer	= {

kernel/events/core.c

+6 −6
Original line number Diff line number Diff line
@@ -1325,7 +1325,7 @@ static void put_ctx(struct perf_event_context *ctx) 
 * function.

 *

 * Lock order:

 *    exec_update_mutex

 *    exec_update_lock

 *	task_struct::perf_event_mutex

 *	  perf_event_context::mutex

 *	    perf_event::child_mutex;
@@ -11721,14 +11721,14 @@ SYSCALL_DEFINE5(perf_event_open, 
	}



	if (task) {

		err = mutex_lock_interruptible(&task->signal->exec_update_mutex);

		err = down_read_interruptible(&task->signal->exec_update_lock);

		if (err)

			goto err_task;



		/*

		 * Preserve ptrace permission check for backwards compatibility.

		 *

		 * We must hold exec_update_mutex across this and any potential

		 * We must hold exec_update_lock across this and any potential

		 * perf_install_in_context() call for this new event to

		 * serialize against exec() altering our credentials (and the

		 * perf_event_exit_task() that could imply).
@@ -12017,7 +12017,7 @@ SYSCALL_DEFINE5(perf_event_open, 
	mutex_unlock(&ctx->mutex);



	if (task) {

		mutex_unlock(&task->signal->exec_update_mutex);

		up_read(&task->signal->exec_update_lock);

		put_task_struct(task);

	}
@@ -12053,7 +12053,7 @@ err_alloc: 
		free_event(event);

err_cred:

	if (task)

		mutex_unlock(&task->signal->exec_update_mutex);

		up_read(&task->signal->exec_update_lock);

err_task:

	if (task)

		put_task_struct(task);
@@ -12358,7 +12358,7 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn) 
/*

 * When a child task exits, feed back event values to parent events.

 *

 * Can be called with exec_update_mutex held when called from

 * Can be called with exec_update_lock held when called from

 * setup_new_exec().

 */

void perf_event_exit_task(struct task_struct *child)

CRA Git | Maintained and supported by SUSTech CRA and CCSE